Authorization Bypass in Clerk JavaScript SDKs
CVE-2026-42349

7.6HIGH

Key Information:

Vendor

Clerk

Status
Javascript
Shared
Backend
Nextjs
Vendor
CVE Published:
11 May 2026

What is CVE-2026-42349?

The Clerk JavaScript SDKs contain an authorization bypass vulnerability that could allow unauthorized users to perform gated actions under certain conditions. This occurs when improper checks are applied within methods such as has() and auth.protect(), leading to situations where a user's access permissions are incorrectly validated. This flaw primarily affects calls combining re-verification checks with authorization criteria like roles, permissions, or billing features, allowing actions that should be restricted. The issue has been addressed in versions 5.125.10 and 6.7.5 of @clerk/clerk-js.

Affected Version(s)

astro >= 2.0.0, <= 2.17.10 <= 2.0.0, 2.17.10

astro >= 3.0.0, <= 3.0.17 <= 3.0.0, 3.0.17

backend >= 2.0.0, <= 2.33.2 <= 2.0.0, 2.33.2

References

https://github.com/clerk/javascript/security/advisories/G...
x_refsource_CONFIRM

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.